CVE-2026-71278

Summary

The vulnerability allows an attacker to create a 'calc rule' without authentication, leading to potential unauthorized access and manipulation of the system.

Exploitability

Exploitation is relatively easy as the endpoint is accessible without authentication. An attacker needs to craft and send a POST request to /calc-rule/create.

Blast radius

If exploited, the attacker could potentially manipulate critical calculations or rules, leading to significant operational disruptions or data corruption.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the '/calc-rule/create' endpoint or restrict access to it via authentication.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.